1/* 2 * (C) 2005-2011 by Pablo Neira Ayuso <pablo@netfilter.org> 3 * 4 * This program is free software; you can redistribute it and/or modify it 5 * under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 */ 9 10#ifndef _LIBNETFILTER_CONNTRACK_H_ 11#define _LIBNETFILTER_CONNTRACK_H_ 12 13#include <stdbool.h> 14#include <netinet/in.h> 15#include <libnfnetlink/linux_nfnetlink.h> 16#include <libnfnetlink/libnfnetlink.h> 17#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h> 18 19#ifdef __cplusplus 20extern "C" { 21#endif 22 23enum { 24 CONNTRACK = NFNL_SUBSYS_CTNETLINK, 25 EXPECT = NFNL_SUBSYS_CTNETLINK_EXP 26}; 27 28/* 29 * Subscribe to all possible conntrack event groups. Use this 30 * flag in case that you want to catch up all the possible 31 * events. Do not use this flag for dumping or any other 32 * similar operation. 33 */ 34#define NFCT_ALL_CT_GROUPS (NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_UPDATE|NF_NETLINK_CONNTRACK_DESTROY) 35 36struct nfct_handle; 37 38/* 39 * [Open|close] a conntrack handler 40 */ 41extern struct nfct_handle *nfct_open(uint8_t, unsigned); 42extern struct nfct_handle *nfct_open2(uint8_t, unsigned, int); 43extern struct nfct_handle *nfct_open_nfnl(struct nfnl_handle *nfnlh, 44 uint8_t subsys_id, 45 unsigned int subscriptions); 46extern struct nfct_handle *nfct_open_nfnl2(struct nfnl_handle *nfnlh, 47 uint8_t subsys_id, 48 unsigned int subscriptions, 49 bool bind); 50extern int nfct_close(struct nfct_handle *cth); 51extern int nfct_close2(struct nfct_handle *cth, bool keep_fd); 52 53extern int nfct_fd(struct nfct_handle *cth); 54extern const struct nfnl_handle *nfct_nfnlh(struct nfct_handle *cth); 55 56/* 57 * NEW libnetfilter_conntrack API 58 */ 59 60/* high level API */ 61 62#include <sys/types.h> 63 64/* conntrack object */ 65struct nf_conntrack; 66 67/* conntrack attributes */ 68enum nf_conntrack_attr { 69 ATTR_ORIG_IPV4_SRC = 0, /* u32 bits */ 70 ATTR_IPV4_SRC = ATTR_ORIG_IPV4_SRC, /* alias */ 71 ATTR_ORIG_IPV4_DST, /* u32 bits */ 72 ATTR_IPV4_DST = ATTR_ORIG_IPV4_DST, /* alias */ 73 ATTR_REPL_IPV4_SRC, /* u32 bits */ 74 ATTR_REPL_IPV4_DST, /* u32 bits */ 75 ATTR_ORIG_IPV6_SRC = 4, /* u128 bits */ 76 ATTR_IPV6_SRC = ATTR_ORIG_IPV6_SRC, /* alias */ 77 ATTR_ORIG_IPV6_DST, /* u128 bits */ 78 ATTR_IPV6_DST = ATTR_ORIG_IPV6_DST, /* alias */ 79 ATTR_REPL_IPV6_SRC, /* u128 bits */ 80 ATTR_REPL_IPV6_DST, /* u128 bits */ 81 ATTR_ORIG_PORT_SRC = 8, /* u16 bits */ 82 ATTR_PORT_SRC = ATTR_ORIG_PORT_SRC, /* alias */ 83 ATTR_ORIG_PORT_DST, /* u16 bits */ 84 ATTR_PORT_DST = ATTR_ORIG_PORT_DST, /* alias */ 85 ATTR_REPL_PORT_SRC, /* u16 bits */ 86 ATTR_REPL_PORT_DST, /* u16 bits */ 87 ATTR_ICMP_TYPE = 12, /* u8 bits */ 88 ATTR_ICMP_CODE, /* u8 bits */ 89 ATTR_ICMP_ID, /* u16 bits */ 90 ATTR_ORIG_L3PROTO, /* u8 bits */ 91 ATTR_L3PROTO = ATTR_ORIG_L3PROTO, /* alias */ 92 ATTR_REPL_L3PROTO = 16, /* u8 bits */ 93 ATTR_ORIG_L4PROTO, /* u8 bits */ 94 ATTR_L4PROTO = ATTR_ORIG_L4PROTO, /* alias */ 95 ATTR_REPL_L4PROTO, /* u8 bits */ 96 ATTR_TCP_STATE, /* u8 bits */ 97 ATTR_SNAT_IPV4 = 20, /* u32 bits */ 98 ATTR_DNAT_IPV4, /* u32 bits */ 99 ATTR_SNAT_PORT, /* u16 bits */ 100 ATTR_DNAT_PORT, /* u16 bits */ 101 ATTR_TIMEOUT = 24, /* u32 bits */ 102 ATTR_MARK, /* u32 bits */ 103 ATTR_ORIG_COUNTER_PACKETS, /* u64 bits */ 104 ATTR_REPL_COUNTER_PACKETS, /* u64 bits */ 105 ATTR_ORIG_COUNTER_BYTES = 28, /* u64 bits */ 106 ATTR_REPL_COUNTER_BYTES, /* u64 bits */ 107 ATTR_USE, /* u32 bits */ 108 ATTR_ID, /* u32 bits */ 109 ATTR_STATUS = 32, /* u32 bits */ 110 ATTR_TCP_FLAGS_ORIG, /* u8 bits */ 111 ATTR_TCP_FLAGS_REPL, /* u8 bits */ 112 ATTR_TCP_MASK_ORIG, /* u8 bits */ 113 ATTR_TCP_MASK_REPL = 36, /* u8 bits */ 114 ATTR_MASTER_IPV4_SRC, /* u32 bits */ 115 ATTR_MASTER_IPV4_DST, /* u32 bits */ 116 ATTR_MASTER_IPV6_SRC, /* u128 bits */ 117 ATTR_MASTER_IPV6_DST = 40, /* u128 bits */ 118 ATTR_MASTER_PORT_SRC, /* u16 bits */ 119 ATTR_MASTER_PORT_DST, /* u16 bits */ 120 ATTR_MASTER_L3PROTO, /* u8 bits */ 121 ATTR_MASTER_L4PROTO = 44, /* u8 bits */ 122 ATTR_SECMARK, /* u32 bits */ 123 ATTR_ORIG_NAT_SEQ_CORRECTION_POS, /* u32 bits */ 124 ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */ 125 ATTR_ORIG_NAT_SEQ_OFFSET_AFTER = 48, /* u32 bits */ 126 ATTR_REPL_NAT_SEQ_CORRECTION_POS, /* u32 bits */ 127 ATTR_REPL_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */ 128 ATTR_REPL_NAT_SEQ_OFFSET_AFTER, /* u32 bits */ 129 ATTR_SCTP_STATE = 52, /* u8 bits */ 130 ATTR_SCTP_VTAG_ORIG, /* u32 bits */ 131 ATTR_SCTP_VTAG_REPL, /* u32 bits */ 132 ATTR_HELPER_NAME, /* string (30 bytes max) */ 133 ATTR_DCCP_STATE = 56, /* u8 bits */ 134 ATTR_DCCP_ROLE, /* u8 bits */ 135 ATTR_DCCP_HANDSHAKE_SEQ, /* u64 bits */ 136 ATTR_TCP_WSCALE_ORIG, /* u8 bits */ 137 ATTR_TCP_WSCALE_REPL = 60, /* u8 bits */ 138 ATTR_ZONE, /* u16 bits */ 139 ATTR_SECCTX, /* string */ 140 ATTR_TIMESTAMP_START, /* u64 bits, linux >= 2.6.38 */ 141 ATTR_TIMESTAMP_STOP = 64, /* u64 bits, linux >= 2.6.38 */ 142 ATTR_HELPER_INFO, /* variable length */ 143 ATTR_CONNLABELS, /* variable length */ 144 ATTR_CONNLABELS_MASK, /* variable length */ 145 ATTR_ORIG_ZONE, /* u16 bits */ 146 ATTR_REPL_ZONE, /* u16 bits */ 147 ATTR_SNAT_IPV6, /* u128 bits */ 148 ATTR_DNAT_IPV6, /* u128 bits */ 149 ATTR_MAX 150}; 151 152/* conntrack attribute groups */ 153enum nf_conntrack_attr_grp { 154 ATTR_GRP_ORIG_IPV4 = 0, /* struct nfct_attr_grp_ipv4 */ 155 ATTR_GRP_REPL_IPV4, /* struct nfct_attr_grp_ipv4 */ 156 ATTR_GRP_ORIG_IPV6, /* struct nfct_attr_grp_ipv6 */ 157 ATTR_GRP_REPL_IPV6, /* struct nfct_attr_grp_ipv6 */ 158 ATTR_GRP_ORIG_PORT = 4, /* struct nfct_attr_grp_port */ 159 ATTR_GRP_REPL_PORT, /* struct nfct_attr_grp_port */ 160 ATTR_GRP_ICMP, /* struct nfct_attr_grp_icmp */ 161 ATTR_GRP_MASTER_IPV4, /* struct nfct_attr_grp_ipv4 */ 162 ATTR_GRP_MASTER_IPV6 = 8, /* struct nfct_attr_grp_ipv6 */ 163 ATTR_GRP_MASTER_PORT, /* struct nfct_attr_grp_port */ 164 ATTR_GRP_ORIG_COUNTERS, /* struct nfct_attr_grp_ctrs */ 165 ATTR_GRP_REPL_COUNTERS, /* struct nfct_attr_grp_ctrs */ 166 ATTR_GRP_ORIG_ADDR_SRC = 12, /* union nfct_attr_grp_addr */ 167 ATTR_GRP_ORIG_ADDR_DST, /* union nfct_attr_grp_addr */ 168 ATTR_GRP_REPL_ADDR_SRC, /* union nfct_attr_grp_addr */ 169 ATTR_GRP_REPL_ADDR_DST, /* union nfct_attr_grp_addr */ 170 ATTR_GRP_MAX 171}; 172 173struct nfct_attr_grp_ipv4 { 174 uint32_t src, dst; 175}; 176 177struct nfct_attr_grp_ipv6 { 178 uint32_t src[4], dst[4]; 179}; 180 181struct nfct_attr_grp_port { 182 uint16_t sport, dport; 183}; 184 185struct nfct_attr_grp_icmp { 186 uint16_t id; 187 uint8_t code, type; 188}; 189 190struct nfct_attr_grp_ctrs { 191 uint64_t packets; 192 uint64_t bytes; 193}; 194 195union nfct_attr_grp_addr { 196 uint32_t ip; 197 uint32_t ip6[4]; 198 uint32_t addr[4]; 199}; 200 201/* message type */ 202enum nf_conntrack_msg_type { 203 NFCT_T_UNKNOWN = 0, 204 205 NFCT_T_NEW_BIT = 0, 206 NFCT_T_NEW = (1 << NFCT_T_NEW_BIT), 207 208 NFCT_T_UPDATE_BIT = 1, 209 NFCT_T_UPDATE = (1 << NFCT_T_UPDATE_BIT), 210 211 NFCT_T_DESTROY_BIT = 2, 212 NFCT_T_DESTROY = (1 << NFCT_T_DESTROY_BIT), 213 214 NFCT_T_ALL = NFCT_T_NEW | NFCT_T_UPDATE | NFCT_T_DESTROY, 215 216 NFCT_T_ERROR_BIT = 31, 217 NFCT_T_ERROR = (1 << NFCT_T_ERROR_BIT), 218}; 219 220/* constructor / destructor */ 221extern struct nf_conntrack *nfct_new(void); 222extern void nfct_destroy(struct nf_conntrack *ct); 223 224/* clone */ 225struct nf_conntrack *nfct_clone(const struct nf_conntrack *ct); 226 227/* object size */ 228extern __attribute__((deprecated)) size_t nfct_sizeof(const struct nf_conntrack *ct); 229 230/* maximum object size */ 231extern __attribute__((deprecated)) size_t nfct_maxsize(void); 232 233/* set option */ 234enum { 235 NFCT_SOPT_UNDO_SNAT, 236 NFCT_SOPT_UNDO_DNAT, 237 NFCT_SOPT_UNDO_SPAT, 238 NFCT_SOPT_UNDO_DPAT, 239 NFCT_SOPT_SETUP_ORIGINAL, 240 NFCT_SOPT_SETUP_REPLY, 241 __NFCT_SOPT_MAX, 242}; 243#define NFCT_SOPT_MAX (__NFCT_SOPT_MAX - 1) 244 245/* get option */ 246enum { 247 NFCT_GOPT_IS_SNAT, 248 NFCT_GOPT_IS_DNAT, 249 NFCT_GOPT_IS_SPAT, 250 NFCT_GOPT_IS_DPAT, 251 __NFCT_GOPT_MAX, 252}; 253#define NFCT_GOPT_MAX (__NFCT_GOPT_MAX - 1) 254 255extern int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option); 256extern int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option); 257 258/* register / unregister callback */ 259 260extern int nfct_callback_register(struct nfct_handle *h, 261 enum nf_conntrack_msg_type type, 262 int (*cb)(enum nf_conntrack_msg_type type, 263 struct nf_conntrack *ct, 264 void *data), 265 void *data); 266 267extern void nfct_callback_unregister(struct nfct_handle *h); 268 269/* register / unregister callback: extended version including netlink header */ 270 271extern int nfct_callback_register2(struct nfct_handle *h, 272 enum nf_conntrack_msg_type type, 273 int (*cb)(const struct nlmsghdr *nlh, 274 enum nf_conntrack_msg_type type, 275 struct nf_conntrack *ct, 276 void *data), 277 void *data); 278 279extern void nfct_callback_unregister2(struct nfct_handle *h); 280 281/* callback verdict */ 282enum { 283 NFCT_CB_FAILURE = -1, /* failure */ 284 NFCT_CB_STOP = 0, /* stop the query */ 285 NFCT_CB_CONTINUE = 1, /* keep iterating through data */ 286 NFCT_CB_STOLEN = 2, /* like continue, but ct is not freed */ 287}; 288 289/* bitmask setter/getter */ 290struct nfct_bitmask; 291 292struct nfct_bitmask *nfct_bitmask_new(unsigned int maxbit); 293struct nfct_bitmask *nfct_bitmask_clone(const struct nfct_bitmask *); 294unsigned int nfct_bitmask_maxbit(const struct nfct_bitmask *); 295 296void nfct_bitmask_set_bit(struct nfct_bitmask *, unsigned int bit); 297int nfct_bitmask_test_bit(const struct nfct_bitmask *, unsigned int bit); 298void nfct_bitmask_unset_bit(struct nfct_bitmask *, unsigned int bit); 299void nfct_bitmask_destroy(struct nfct_bitmask *); 300void nfct_bitmask_clear(struct nfct_bitmask *); 301bool nfct_bitmask_equal(const struct nfct_bitmask *, const struct nfct_bitmask *); 302 303/* connlabel name <-> bit translation mapping */ 304struct nfct_labelmap; 305 306const char *nfct_labels_get_path(void); 307struct nfct_labelmap *nfct_labelmap_new(const char *mapfile); 308void nfct_labelmap_destroy(struct nfct_labelmap *map); 309const char *nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit); 310int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name); 311 312/* setter */ 313extern void nfct_set_attr(struct nf_conntrack *ct, 314 const enum nf_conntrack_attr type, 315 const void *value); 316 317extern void nfct_set_attr_u8(struct nf_conntrack *ct, 318 const enum nf_conntrack_attr type, 319 uint8_t value); 320 321extern void nfct_set_attr_u16(struct nf_conntrack *ct, 322 const enum nf_conntrack_attr type, 323 uint16_t value); 324 325extern void nfct_set_attr_u32(struct nf_conntrack *ct, 326 const enum nf_conntrack_attr type, 327 uint32_t value); 328 329extern void nfct_set_attr_u64(struct nf_conntrack *ct, 330 const enum nf_conntrack_attr type, 331 uint64_t value); 332 333extern void nfct_set_attr_l(struct nf_conntrack *ct, 334 const enum nf_conntrack_attr type, 335 const void *value, 336 size_t len); 337 338/* getter */ 339extern const void *nfct_get_attr(const struct nf_conntrack *ct, 340 const enum nf_conntrack_attr type); 341 342extern uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct, 343 const enum nf_conntrack_attr type); 344 345extern uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct, 346 const enum nf_conntrack_attr type); 347 348extern uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct, 349 const enum nf_conntrack_attr type); 350 351extern uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct, 352 const enum nf_conntrack_attr type); 353 354/* checker */ 355extern int nfct_attr_is_set(const struct nf_conntrack *ct, 356 const enum nf_conntrack_attr type); 357 358extern int nfct_attr_is_set_array(const struct nf_conntrack *ct, 359 const enum nf_conntrack_attr *type_array, 360 int size); 361 362/* unsetter */ 363extern int nfct_attr_unset(struct nf_conntrack *ct, 364 const enum nf_conntrack_attr type); 365 366/* group setter */ 367extern void nfct_set_attr_grp(struct nf_conntrack *ct, 368 const enum nf_conntrack_attr_grp type, 369 const void *value); 370/* group getter */ 371extern int nfct_get_attr_grp(const struct nf_conntrack *ct, 372 const enum nf_conntrack_attr_grp type, 373 void *data); 374 375/* group checker */ 376extern int nfct_attr_grp_is_set(const struct nf_conntrack *ct, 377 const enum nf_conntrack_attr_grp type); 378 379/* unsetter */ 380extern int nfct_attr_grp_unset(struct nf_conntrack *ct, 381 const enum nf_conntrack_attr_grp type); 382 383/* print */ 384 385/* output type */ 386enum { 387 NFCT_O_PLAIN, 388 NFCT_O_DEFAULT = NFCT_O_PLAIN, 389 NFCT_O_XML, 390 NFCT_O_MAX 391}; 392 393/* output flags */ 394enum { 395 NFCT_OF_SHOW_LAYER3_BIT = 0, 396 NFCT_OF_SHOW_LAYER3 = (1 << NFCT_OF_SHOW_LAYER3_BIT), 397 398 NFCT_OF_TIME_BIT = 1, 399 NFCT_OF_TIME = (1 << NFCT_OF_TIME_BIT), 400 401 NFCT_OF_ID_BIT = 2, 402 NFCT_OF_ID = (1 << NFCT_OF_ID_BIT), 403 404 NFCT_OF_TIMESTAMP_BIT = 3, 405 NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT), 406}; 407 408extern int nfct_snprintf(char *buf, 409 unsigned int size, 410 const struct nf_conntrack *ct, 411 const unsigned int msg_type, 412 const unsigned int out_type, 413 const unsigned int out_flags); 414 415extern int nfct_snprintf_labels(char *buf, 416 unsigned int size, 417 const struct nf_conntrack *ct, 418 const unsigned int msg_type, 419 const unsigned int out_type, 420 const unsigned int out_flags, 421 struct nfct_labelmap *map); 422 423/* comparison */ 424extern int nfct_compare(const struct nf_conntrack *ct1, 425 const struct nf_conntrack *ct2); 426 427enum { 428 NFCT_CMP_ALL = 0, 429 NFCT_CMP_ORIG = (1 << 0), 430 NFCT_CMP_REPL = (1 << 1), 431 NFCT_CMP_TIMEOUT_EQ = (1 << 2), 432 NFCT_CMP_TIMEOUT_GT = (1 << 3), 433 NFCT_CMP_TIMEOUT_GE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_GT), 434 NFCT_CMP_TIMEOUT_LT = (1 << 4), 435 NFCT_CMP_TIMEOUT_LE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_LT), 436 NFCT_CMP_MASK = (1 << 5), 437 NFCT_CMP_STRICT = (1 << 6), 438}; 439 440extern int nfct_cmp(const struct nf_conntrack *ct1, 441 const struct nf_conntrack *ct2, 442 unsigned int flags); 443 444 445/* query */ 446enum nf_conntrack_query { 447 NFCT_Q_CREATE, 448 NFCT_Q_UPDATE, 449 NFCT_Q_DESTROY, 450 NFCT_Q_GET, 451 NFCT_Q_FLUSH, 452 NFCT_Q_DUMP, 453 NFCT_Q_DUMP_RESET, 454 NFCT_Q_CREATE_UPDATE, 455 NFCT_Q_DUMP_FILTER, 456 NFCT_Q_DUMP_FILTER_RESET, 457}; 458 459extern int nfct_query(struct nfct_handle *h, 460 const enum nf_conntrack_query query, 461 const void *data); 462 463extern int nfct_send(struct nfct_handle *h, 464 const enum nf_conntrack_query query, 465 const void *data); 466 467extern int nfct_catch(struct nfct_handle *h); 468 469/* copy */ 470enum { 471 NFCT_CP_ALL = 0, 472 NFCT_CP_ORIG = (1 << 0), 473 NFCT_CP_REPL = (1 << 1), 474 NFCT_CP_META = (1 << 2), 475 NFCT_CP_OVERRIDE = (1 << 3), 476}; 477 478extern void nfct_copy(struct nf_conntrack *dest, 479 const struct nf_conntrack *source, 480 unsigned int flags); 481 482extern void nfct_copy_attr(struct nf_conntrack *ct1, 483 const struct nf_conntrack *ct2, 484 const enum nf_conntrack_attr type); 485 486/* event filtering */ 487 488struct nfct_filter; 489 490extern struct nfct_filter *nfct_filter_create(void); 491extern void nfct_filter_destroy(struct nfct_filter *filter); 492 493struct nfct_filter_proto { 494 uint16_t proto; 495 uint16_t state; 496}; 497struct nfct_filter_ipv4 { 498 uint32_t addr; 499 uint32_t mask; 500}; 501struct nfct_filter_ipv6 { 502 uint32_t addr[4]; 503 uint32_t mask[4]; 504}; 505 506enum nfct_filter_attr { 507 NFCT_FILTER_L4PROTO = 0, /* uint32_t */ 508 NFCT_FILTER_L4PROTO_STATE, /* struct nfct_filter_proto */ 509 NFCT_FILTER_SRC_IPV4, /* struct nfct_filter_ipv4 */ 510 NFCT_FILTER_DST_IPV4, /* struct nfct_filter_ipv4 */ 511 NFCT_FILTER_SRC_IPV6, /* struct nfct_filter_ipv6 */ 512 NFCT_FILTER_DST_IPV6, /* struct nfct_filter_ipv6 */ 513 NFCT_FILTER_MARK, /* struct nfct_filter_dump_mark */ 514 NFCT_FILTER_MAX 515}; 516 517extern void nfct_filter_add_attr(struct nfct_filter *filter, 518 const enum nfct_filter_attr attr, 519 const void *value); 520 521extern void nfct_filter_add_attr_u32(struct nfct_filter *filter, 522 const enum nfct_filter_attr attr, 523 const uint32_t value); 524 525enum nfct_filter_logic { 526 NFCT_FILTER_LOGIC_POSITIVE, 527 NFCT_FILTER_LOGIC_NEGATIVE, 528 NFCT_FILTER_LOGIC_MAX 529}; 530 531extern int nfct_filter_set_logic(struct nfct_filter *filter, 532 const enum nfct_filter_attr attr, 533 const enum nfct_filter_logic logic); 534 535extern int nfct_filter_attach(int fd, struct nfct_filter *filter); 536extern int nfct_filter_detach(int fd); 537 538/* dump filtering */ 539 540struct nfct_filter_dump; 541 542struct nfct_filter_dump_mark { 543 uint32_t val; 544 uint32_t mask; 545}; 546 547enum nfct_filter_dump_attr { 548 NFCT_FILTER_DUMP_MARK = 0, /* struct nfct_filter_dump_mark */ 549 NFCT_FILTER_DUMP_L3NUM, /* uint8_t */ 550 NFCT_FILTER_DUMP_MAX 551}; 552 553struct nfct_filter_dump *nfct_filter_dump_create(void); 554 555void nfct_filter_dump_destroy(struct nfct_filter_dump *filter); 556 557void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump, 558 const enum nfct_filter_dump_attr type, 559 const void *data); 560 561void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump, 562 const enum nfct_filter_dump_attr type, 563 uint8_t data); 564 565/* low level API: netlink functions */ 566 567extern __attribute__((deprecated)) int 568nfct_build_conntrack(struct nfnl_subsys_handle *ssh, 569 void *req, 570 size_t size, 571 uint16_t type, 572 uint16_t flags, 573 const struct nf_conntrack *ct); 574 575extern __attribute__((deprecated)) 576int nfct_parse_conntrack(enum nf_conntrack_msg_type msg, 577 const struct nlmsghdr *nlh, 578 struct nf_conntrack *ct); 579 580extern __attribute__((deprecated)) 581int nfct_build_query(struct nfnl_subsys_handle *ssh, 582 const enum nf_conntrack_query query, 583 const void *data, 584 void *req, 585 unsigned int size); 586 587/* New low level API: netlink functions */ 588 589extern int nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct); 590extern int nfct_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_conntrack *ct); 591extern int nfct_payload_parse(const void *payload, size_t payload_len, uint16_t l3num, struct nf_conntrack *ct); 592 593/* 594 * NEW expectation API 595 */ 596 597/* expectation object */ 598struct nf_expect; 599 600/* expect attributes */ 601enum nf_expect_attr { 602 ATTR_EXP_MASTER = 0, /* pointer to conntrack object */ 603 ATTR_EXP_EXPECTED, /* pointer to conntrack object */ 604 ATTR_EXP_MASK, /* pointer to conntrack object */ 605 ATTR_EXP_TIMEOUT, /* u32 bits */ 606 ATTR_EXP_ZONE, /* u16 bits */ 607 ATTR_EXP_FLAGS, /* u32 bits */ 608 ATTR_EXP_HELPER_NAME, /* string (16 bytes max) */ 609 ATTR_EXP_CLASS, /* u32 bits */ 610 ATTR_EXP_NAT_TUPLE, /* pointer to conntrack object */ 611 ATTR_EXP_NAT_DIR, /* u8 bits */ 612 ATTR_EXP_FN, /* string */ 613 ATTR_EXP_MAX 614}; 615 616/* constructor / destructor */ 617extern struct nf_expect *nfexp_new(void); 618extern void nfexp_destroy(struct nf_expect *exp); 619 620/* clone */ 621extern struct nf_expect *nfexp_clone(const struct nf_expect *exp); 622 623/* object size */ 624extern size_t nfexp_sizeof(const struct nf_expect *exp); 625 626/* maximum object size */ 627extern size_t nfexp_maxsize(void); 628 629/* register / unregister callback */ 630 631extern int nfexp_callback_register(struct nfct_handle *h, 632 enum nf_conntrack_msg_type type, 633 int (*cb)(enum nf_conntrack_msg_type type, 634 struct nf_expect *exp, 635 void *data), 636 void *data); 637 638extern void nfexp_callback_unregister(struct nfct_handle *h); 639 640/* register / unregister callback: extended version including netlink header */ 641extern int nfexp_callback_register2(struct nfct_handle *h, 642 enum nf_conntrack_msg_type type, 643 int (*cb)(const struct nlmsghdr *nlh, 644 enum nf_conntrack_msg_type type, 645 struct nf_expect *exp, 646 void *data), 647 void *data); 648 649extern void nfexp_callback_unregister2(struct nfct_handle *h); 650 651/* setter */ 652extern void nfexp_set_attr(struct nf_expect *exp, 653 const enum nf_expect_attr type, 654 const void *value); 655 656extern void nfexp_set_attr_u8(struct nf_expect *exp, 657 const enum nf_expect_attr type, 658 uint8_t value); 659 660extern void nfexp_set_attr_u16(struct nf_expect *exp, 661 const enum nf_expect_attr type, 662 uint16_t value); 663 664extern void nfexp_set_attr_u32(struct nf_expect *exp, 665 const enum nf_expect_attr type, 666 uint32_t value); 667 668/* getter */ 669extern const void *nfexp_get_attr(const struct nf_expect *exp, 670 const enum nf_expect_attr type); 671 672extern uint8_t nfexp_get_attr_u8(const struct nf_expect *exp, 673 const enum nf_expect_attr type); 674 675extern uint16_t nfexp_get_attr_u16(const struct nf_expect *exp, 676 const enum nf_expect_attr type); 677 678extern uint32_t nfexp_get_attr_u32(const struct nf_expect *exp, 679 const enum nf_expect_attr type); 680 681/* checker */ 682extern int nfexp_attr_is_set(const struct nf_expect *exp, 683 const enum nf_expect_attr type); 684 685/* unsetter */ 686extern int nfexp_attr_unset(struct nf_expect *exp, 687 const enum nf_expect_attr type); 688 689/* query */ 690extern int nfexp_query(struct nfct_handle *h, 691 const enum nf_conntrack_query qt, 692 const void *data); 693 694/* print */ 695extern int nfexp_snprintf(char *buf, 696 unsigned int size, 697 const struct nf_expect *exp, 698 const unsigned int msg_type, 699 const unsigned int out_type, 700 const unsigned int out_flags); 701 702/* compare */ 703extern int nfexp_cmp(const struct nf_expect *exp1, 704 const struct nf_expect *exp2, 705 unsigned int flags); 706 707extern int nfexp_send(struct nfct_handle *h, 708 const enum nf_conntrack_query qt, 709 const void *data); 710 711extern int nfexp_catch(struct nfct_handle *h); 712 713/* low level API */ 714extern __attribute__((deprecated)) 715int nfexp_build_expect(struct nfnl_subsys_handle *ssh, 716 void *req, 717 size_t size, 718 uint16_t type, 719 uint16_t flags, 720 const struct nf_expect *exp); 721 722extern __attribute__((deprecated)) 723int nfexp_parse_expect(enum nf_conntrack_msg_type type, 724 const struct nlmsghdr *nlh, 725 struct nf_expect *exp); 726 727extern __attribute__((deprecated)) 728int nfexp_build_query(struct nfnl_subsys_handle *ssh, 729 const enum nf_conntrack_query qt, 730 const void *data, 731 void *buffer, 732 unsigned int size); 733 734/* New low level API: netlink functions */ 735 736extern int nfexp_nlmsg_build(struct nlmsghdr *nlh, const struct nf_expect *exp); 737extern int nfexp_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_expect *exp); 738 739/* Bitset representing status of connection. Taken from ip_conntrack.h 740 * 741 * Note: For backward compatibility this shouldn't ever change 742 * in kernel space. 743 */ 744enum ip_conntrack_status { 745 /* It's an expected connection: bit 0 set. This bit never changed */ 746 IPS_EXPECTED_BIT = 0, 747 IPS_EXPECTED = (1 << IPS_EXPECTED_BIT), 748 749 /* We've seen packets both ways: bit 1 set. Can be set, not unset. */ 750 IPS_SEEN_REPLY_BIT = 1, 751 IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT), 752 753 /* Conntrack should never be early-expired. */ 754 IPS_ASSURED_BIT = 2, 755 IPS_ASSURED = (1 << IPS_ASSURED_BIT), 756 757 /* Connection is confirmed: originating packet has left box */ 758 IPS_CONFIRMED_BIT = 3, 759 IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT), 760 761 /* Connection needs src nat in orig dir. This bit never changed. */ 762 IPS_SRC_NAT_BIT = 4, 763 IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT), 764 765 /* Connection needs dst nat in orig dir. This bit never changed. */ 766 IPS_DST_NAT_BIT = 5, 767 IPS_DST_NAT = (1 << IPS_DST_NAT_BIT), 768 769 /* Both together. */ 770 IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT), 771 772 /* Connection needs TCP sequence adjusted. */ 773 IPS_SEQ_ADJUST_BIT = 6, 774 IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT), 775 776 /* NAT initialization bits. */ 777 IPS_SRC_NAT_DONE_BIT = 7, 778 IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT), 779 780 IPS_DST_NAT_DONE_BIT = 8, 781 IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT), 782 783 /* Both together */ 784 IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE), 785 786 /* Connection is dying (removed from lists), can not be unset. */ 787 IPS_DYING_BIT = 9, 788 IPS_DYING = (1 << IPS_DYING_BIT), 789 790 /* Connection has fixed timeout. */ 791 IPS_FIXED_TIMEOUT_BIT = 10, 792 IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT), 793 794 /* Conntrack is a template */ 795 IPS_TEMPLATE_BIT = 11, 796 IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT), 797 798 /* Conntrack is a fake untracked entry */ 799 IPS_UNTRACKED_BIT = 12, 800 IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT), 801}; 802 803/* expectation flags */ 804#define NF_CT_EXPECT_PERMANENT 0x1 805#define NF_CT_EXPECT_INACTIVE 0x2 806#define NF_CT_EXPECT_USERSPACE 0x4 807 808/* 809 * TCP flags 810 */ 811 812/* Window scaling is advertised by the sender */ 813#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01 814 815/* SACK is permitted by the sender */ 816#define IP_CT_TCP_FLAG_SACK_PERM 0x02 817 818/* This sender sent FIN first */ 819#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04 820 821/* Be liberal in window checking */ 822#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08 823 824/* WARNING: do not use these constants in new applications, we keep them here 825 * to avoid breaking backward compatibility. */ 826#define NFCT_DIR_ORIGINAL 0 827#define NFCT_DIR_REPLY 1 828#define NFCT_DIR_MAX NFCT_DIR_REPLY+1 829 830/* xt_helper uses a length size of 30 bytes, however, no helper name in 831 * the tree has exceeded 16 bytes length. Since 2.6.29, the maximum 832 * length accepted is 16 bytes, this limit is enforced during module load. */ 833#define NFCT_HELPER_NAME_MAX 16 834 835#ifdef __cplusplus 836} 837#endif 838 839#endif /* _LIBNETFILTER_CONNTRACK_H_ */ 840